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REMARKS 

In view of the following discussion, the Applicants submit that none of the claims 
now pending in the application is anticipated under the provisions of 35 U.S.C. § 102 or 
obvious under the provisions of 35 U.S.C. § 103. Thus, the Applicants t>elieve that all of 
these claims are in allowable form. 

I, REJECTION OF CLAIMS 1-2 AND 4-5 UNDER 35 U.S.C, S 102 

Claims 1-2 and 4-5 stand rejected as being anticipated by the Nine et al. patent 
(U.S. 6,560,611, issued May 6, 2003, hereinafter "Nine"). In response* the Applicants 
have amended independent claim 1, from which claim 2 depends, as well as 
independent claims 4 and 5. in order to more clearly recite aspects of the present 
invention. 

Particularly, the Examiner's attention is directed to the fact that Nine fails to 
disclose or suggest the novel invention of adjusting a belief state of a first sensor 
regarding a system resource or senrice directly monitored bv the first sensor , based on 
a belief state of a second sensor regarding a system resource or service directly 
monitored by the second sensor, as claimed in Applicants' independent claims 1, 4 and 
5. 

By contrast, Nine teaches a system wherein a remote monitoring system (RMS) 
server, which monitors a network service, environmental condition or security service at 
a client site, reports to a central accounting system (CAS) server at a central location (a 
network operation site or NOS). The CAS server, in turn, collects the reports from the 
RMS server and, if necessary, notifies a human operator. Thus, no direct monitoring of 
resources occurs at the CAS server; it merely serves as a collection point for reports 
from the RMS servers. Collecting reports from remote monitoring systems is not the 
same as directly monitoring a system resource or service and adjusting a belief state 
pertaining to the directly monitored resource or service based on the receive d reports, 
as recited by the Applicants in independent claims 1 , 4 and 5. Specifically, Applicants' 
claims 1 . 4 and 5, as amended, positively recite: 

1. A method for correlating a first sensor to a second sensor in an intrusion 
detection system, the first and second sensors each maintaining belief over a number of 
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possible states of the system, the method comprising the steps of: 

(a) transmitting to the first sensor infomnation about the second sensor's belief 
state, said belief state indicating a state of at least one system resource or service 
directly monitored by the second sensor; and 

(b) adjusting a prior belief state of the first sensor, said belief state indicating 
a state of at least one system resource or service directly monitored bv the first sensor 
the adjustment based at least in part on the second sensor's belief state. (Emphasis 
added) 



4. A method for reducing false alarms generated by an intrusion detection system 
when a monitored resource is degraded or compromised, the intmsion detection system 
having a first and second sensors each maintaining belief over a number of possible 
states of the system, the method comprising the steps of: 

(a) transmitting to the first sensor all or part of the belief of the second sensor 
regarding an apparent normal, degraded or compromised state of a resource directly 
monitored by the second sensor; and 

(b) adjusting a prior belief state of the first sensor regarding an apparent 
normal, degraded or compromised state of a resource directly monitored by the first 
sensor so that an erroneous transaction with the degraded or compromised resource 
does not generate an alarm. (Emphasis added) 



5. A method for enhancing the sensitivity of an intrusion detection system that 
monitors a plurality of computer system resources, the intrusion detection system 
having a first and second sensors each maintaining belief over a number of possible 
states of the system, the method comprising the steps of: 

(a) transmitting to the first sensor all or part of the belief of the second sensor 
regarding the existence or validity of services supported on computer system resources 
directly monitored by the second sensor; and 

(b) adjusting a prior belief state of the first sensor regarding the existence or 
validity of services supported on computer system resources directly monitored bv the 
first sensor so that an attempted communication with a nonexistent system service or 
resource appears suspicious. (Emphasis added) 

As discussed above, Nine does not teach or even suggest the desirability of 
adjusting a belief state of a first sensor regarding a system resource or service directly 
monitored by the first sensor , based on a belief state of a second sensor regarding a 
system resource or sen/ice directly monitored by the second sensor. Therefore, the 
Applicants submit that independent claims 1 , 4 and 5 fully satisfy the requirements of 35 
U.S.C. §102 and are patentable thereunder. 

Dependent claim 2 depends from claim 1 and recites additional features 
therefore. As such, and for at least the same reasons set forth above, the Applicants 
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submit that claim 2 is not anticipated by the teachings of Nine. Therefore, the 
Applicants submit that dependent claim 2 also fully satisfies the requirements of 35 
U.S.C. §102 and is patentable thereunder. 

II- REJECTION OF CLAIM 3 UNDER 35 U.S.C. S 103 

Claim 3 stands rejected as being unpatentable over Nine in view of the Timm 
patent (U.S. 5.440,498, hereinafter "Timm"). In response, the Applicants have amended 
independent claims 1, 4 and 5, from which claim 2 depends, in order to more clearly 
recite aspects of the present invention. 

The Examiner's attention is directed to the fact that Nine and Timm, singularly or 
in any permissible combination, ^il to disclose or suggest the novel invention of 
adjusting a belief state of a first sensor regarding a system resource or service directly 
monitored by the first sensor , based on a belief state of a second sensor regarding a 
system resource or service directly monitored by the second sensor, as claimed in 
Applicants' independent claim 1, from which claim 3 depends. Applicants' claim 1 has 
been recited above. 

As discussed above, Nine does not teach or even suggest the desirability of 
adjusting a belief state of a sensor relating to a state of a system resource or service 
directly monitored bv the sensor , based on a belief state of another sensor regarding 
another system resource or service . Timm does not bridge this gap in the teachings of 
Nine. Nine and Timm, singularly or in any permissible combination, thus fail to teach, 
suggest or make obvious a method in which a first sensor's belief state relating to a 
state of a network resource or service directly monitored thereby is adjusted based on 
at least part of a second sensor's belief state , as positively claimed by the Applicants in 
claim 1. Therefore, the Applicants submit that independent claim 1 fully satisfies the 
requirements of 35 U.S.C. §1 03 and is patentable thereunder. 

Dependent claim 3 depends from claim 1 and recites additional features 
therefore. As such, and for at least the same reasons set forth above, the Applicants 
submit that claim 3 is not made obvious by the teachings of Nine in view of Timm. 
Therefore, the Applicants submit that dependent claim 3 also fully satisfies the 
requirements of 35 U.S.C. §103 and is patentable thereunder. 
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IIL NEW CLAIMS 

The Applicants have added new claims 10, 11 and 12, which present the subject 
matter of existing claims 1 . 4 and 5, respectively, in computer readable medium form. 

IV, CONCLUSION 

Thus, the Applicants submit that all of the presented claims fully satisfy the 
requirements of 35 U.S.C. §102 and 35 U.S.C. §103. Consequently, the Applicants 
believe that all of these claims are presently in condition for allowance. Accordingly, 
both reconsideration of this application and its svAit passage to issue are earnestly 
solicited. 

If, however, the Examiner believes that there are any unresolved issues requiring 
the issuance of a final action in any of the claims now pending in the application, it is 
requested that the Examiner telephone Mr Kin-Wah Tonq. Esq. at (732) 530-9404 so 
that appropriate arrangements can be made for resolving such issues as expeditiously 
as possible. 




Respectfully submitted, 




Reg. No. 39,400 
(732) 530-9404 



Patterson & Sheridan, LLP 
595 Shrewsbury Avenue 
Shrewsbury. New Jersey 07702 
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